HS 2.0R2: Fix OSEN IE parsing for in cipher setup (CID 68132)

The OSEN code path hardcodes number of struct wpa_ie_data items.
However, it did not clear the full structure and some uninitialized
fields could have been used (e.g., ie.mgmt_group_cipher for a debug
print and ie.capabilities for checking MFPC). Fix this by clearing the
ie data before filling in the hardcoded OSEN values.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index ffba0f5e7803f6237f1635160d2d8dfe1d10de4d..c4d5cb25124d66a90317fef50813512dc7f61e9f 100644 (file)
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -984,6 +984,7 @@ int wpa_supplicant_set_suites(struct wpa_supplicant *wpa_s,
        } else if (bss_osen && (ssid->proto & WPA_PROTO_OSEN)) {
                wpa_dbg(wpa_s, MSG_DEBUG, "HS 2.0: using OSEN");
                /* TODO: parse OSEN element */
+               os_memset(&ie, 0, sizeof(ie));
                ie.group_cipher = WPA_CIPHER_CCMP;
                ie.pairwise_cipher = WPA_CIPHER_CCMP;
                ie.key_mgmt = WPA_KEY_MGMT_OSEN;